NEW
Font size
WorksheetsCybersecurity Final Exam Review
Total questions: 20
Worksheet time: 10mins
Which should come first in malware analysis - static or dynamic?
static
dynamic
neither - should be done at the same time
they are the same thing
What are the tools called that obfuscates malware, compresses or encrypts malware and contains anti-analysis features?
wrappers
trojans
packers
none of the above
When doing dynamic malware analysis, it is important to ...
make the environment it is being tested in as "real life" looking as possible
make sure the environment is self contained - is a "host only" machine
both of these
neither of these
To take the malware and figure out how it was built is called
Dynamic Analysis
Reverse Engineering
Build Wrapping
None of the above
What is a Hex Dump?
Removing all negative features of the software
Displaying what exactly is in each byte of the software
Interpreting the characters that make up a compressed file.
None of the above
When generating the Hash of a File you are
Determining if it is malicious or not
Determining what is in each of the bytes of the file
Making the file no longer dangerous
None of the above
When doing Reverse Engineering - one stage is modeling - this means:
Recreating code that does the same thing but can be controled
Breaking the program down to understand the impact of each part
Comparing the malware operation to other known applications by running them side by side
None of the above
What is John the Ripper?
Reformats Malware to make it no longer dangerous
Tells you what files contain malware
Scans your system to know where malware is hidden
None of the above
The purpose of Virus Total is to
Tell you if a file is known to be dangerous
Tells you if a website is known to be dangerous
Uses many Engines in the same scan
All of the above
Who owns Virus Total?
Amazon Web Services
VirusTotal Inc.
None of the above
When using Virus Total - what things to you need to look for?
Is the file signed?
Does the file have alternative valid looking names?
Are all the dates of previous submissions all very similar and very recent?
all of the above
When going to a website,
always rely on URL automatic completion
always rely on typing it out completely
always rely on the URL given to you by a friend
none of the above
When looking for URLs in the character interpretation of the file, this is called
URL scanning
Embedded String Analysis
URL strings
none of the above
What is the purpose of ProcDOT
A recording of the procedure for malware analysis
A safe environment for malware analysis
A Procurement Document for malware analysis
none of the above
What is a PCAP file?
A file created from a packet capture
A report from Wireshark
A report of all malware on the system
none of the above
When scanning a system for vulnerabilities this is called
malware analysis
pen testing
static analysis
none of the above
What is the type of testing where the system administrator gives you all the infromation they have about the system?
Tested Box
Open Box
Closed Box
none of the above
What is NMAP?
Footprinting tool
Network Topology Map
Scanner for malware
none of the above
Why do a Cookie Echo scan?
To determine if the machine you are pen testing put any cookies on your machine
To determine if the machine will accept cookies
Because determining what cookies the machine uses is usually less protected
none of the above
What is SQLMap used for?
To setup the structure of an SQL database
To install SQL in a safe way
To scan for any known SQL vulnerabilities
None of the above
